Database
Critical WordPress vulnerabilities (page 1299)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.8Update to 2.8.1
- Medium6.1Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.3.1Update to 2.3.1
- Medium6.1Reflected Cross-Site Scripting
Contact Form Email
<1.2.66Update to 1.2.66
- Medium6.1Reflected Cross-Site Scripting via poll_id Parameter
YOP Poll
<6.0.3Update to 6.0.3
- Medium6.1Reflected Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤7.10.41Update to 7.10.43
- High7.2Stored Cross-Site Scripting
WP Support Plus Responsive Ticket System
<9.1.2Update to 9.1.2
- Medium6.1Stored Cross-Site Scripting
WP Support Plus Responsive Ticket System
<9.1.2Update to 9.1.2
- Medium6.1Cross-Site Scripting
Parallax Scroll by adamrob.co.uk
<2.1Update to 2.1
- High8.1WordPress Custom Fields Framework <= 4.16.2 - File Deletion via attachment_id Parameter
Meta Box – A Framework for Dynamic Websites
<4.16.3Update to 4.16.3
- High7.5Mishandling of File Upload
Meta Box – A Framework for Dynamic Websites
≤4.16.1Update to 4.16.2
- Critical9.8Unauthenticated PHP Object Injection
YASR – Yet Another Star Rating Plugin for WordPress
≤1.8.6Update to 1.8.7
- Medium6.1Reverse Tabnabbing
Wise Chat
<2.7Update to 2.7
- Critical9.8Missing Authorization to Arbitrary Options Update
Total Donations
≤2.0.5Update to 3.0.0
- Critical9.8Social Media API Key Leakage <= 1.7.1 - Information Exposure
Social Network Tabs
≤1.7.1No patch available
- Critical9.8Local File Inclusion
Shortcode Factory
≤2.7Update to 2.8
- Medium6.1Cross-Site Scripting
Easy Redirect Manager
≤2.18.18No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
spam-byebye
≤2.2.1Update to 2.2.2
- Medium6.1Stored Cross-Site Scripting
Gallery Images Ape
≤1.6.14Update to 2.0.0
- High8.8Cross-Site Request Forgery and Local File Inclusion
Companion Sitemap Generator – Simple, Smart, and SEO-Ready
≤3.6.6Update to 3.7.0
- Medium6.1Cross-Site Request Forgery
MapSVG – Vector maps, Google Maps, Image maps – with AI assistant
<3.3.0Update to 3.3.0
- Critical9.8Arbitrary File Upload
Baggage Freight Shipping Australia
≤0.1.0No patch available
- Critical9.8Arbitrary File Upload
Audio Record
≤1.0No patch available
- Medium6.1Cross-Site Scripting
JSmol2WP
≤1.07No patch available
- Critical9.8SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.21.1Update to 3.3.21.2
- Critical10.0Privilege Escalation
UserPro - Community and User Profile WordPress Plugin
<4.9.21Update to 4.9.21
- High8.8SQL injection
Booking Calendar
≤8.4.3Update to 8.4.4
- Medium5.5Authenticated Cross-Site Scripting
XML Sitemap Generator for Google
≤4.0.9Update to 4.1.0
- High7.5Server-Side Request Forgery
JSmol2WP
≤1.07No patch available
- High8.8Cross-Site Request Forgery
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export
<1.4.2Update to 1.4.2
- High8.8Cross-Site Request Forgery
Two Factor Authentication
<1.3.13Update to 1.3.13